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VEHICLE TRACKING SYSTEM USING 
CELLULAR NETWORK 

FIELD OF THE INVENTION 

This invention relates to vehicle tracking systems, but 3 
more particularly, to a vehicle tracking system which makes 
use of the existing cellular network infrastructure. 

BACKGROUND OF THE INVENTION 

Various systems have been suggested to date to enable the lC 
locating and tracking of stolen or missing vehicles. These 
systems are generally categorized in two groups, namely 
those which make use of existing police radio communica- 
tion infrastructures and those which make use of existing 
cellular network infrastructures. 13 

US. Pat Nos. 4.818.998 and 4.908.629 which both issued 
to Apsell et al are directed to the former. That is. ApseU et 
al teach the use of an apparatus and method for tracking 
vehicles equipped with computer-registered transponders ^ 
which may be located or tracked by appropriately equipped 
police direction-finding vehicles. The police tracking the 
stolen vehicles home in on periodic transponder reply radio 
transmissions which are activated by command activation 
signals. ^ 

The problem associated with such systems, is that special 
police radio infrastructures are required in order to track and 
locate the stolen vehicles. In addition, unless the police 
vehicle is located in the same general area as the stolen 
vehicle, it is unlikely that the stolen vehicle can be located 
in view of the limited range of transmission between the 
stolen vehicle and police vehicle as well as any broadcast 
towers used with this invention. Also, once a car is removed 
from a city provided with this infrastructure, it will likely 
never be found since the system operates solely in a dry 35 
having the specified system. 

Because of their wide service area, cellular networks offer 
advantages over the aforementioned tracking systems. A 
vehicle cracking system making use of a cellular network is 
disclosed in U.S. PaL No. 5.299.132. In this system, a 40 
cellular telephone in a vehicle is interrogated to obtain 
location information received by the cellular phone in an 
overhead message stream transmitted from the cellular net- 
work. Once a reply to the interrogation is received at the host 
controller, the location of the vehicle is displayed. A micro- 45 
processor at the cellular phone checks the serial identifica- 
tion number and a database for dial-out procedure to the host 
controller upon being interrogated to obtain location infor- 
mation. 

Yet another system for tracking vehicles which makes use 50 
of a cellular network is disclosed in U.S. Pat. No. 5.208.75& 
With this system, a small hidden device located in the 
vehicle is activated through DTMF signals transmitted from 
any telephone station. Upon activation, the device deter- 
mines the power at which normally transmitted control 53 
channels are received from several base stations of the 
network. Based upon these determinations, the device then 
calculates the distance between the vehicle and each of the 
base stations and, using rriangulation or arculation. deter- 
mines the location of the vehicle. The location information 60 
is then transmitted through a voice synthesizer back to the 
telephone station from which the activation signal Is 
received. The location information is also transmitted digi- 
tally to a central station where the position of the vehicle is 
displayed on a computer screen along with a graphical 65 
representation of a map of the region served by the cellular 
telephone network. 
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U.S. Pat. No. 5J218367 makes use of the cellular network 
by sending an emergency message transmission to a remote 
monitoring station in the event a theft sensor is activated on 
the vehicle. The monitoring system then detects the cell site 

5 identification codes from adjacent cellular transmitter and 
provides a message including the vehicle identification, cell 
site identification and signal RSSL A computer located at a 
centra] station then provides a determination of the location 
of the stolen vehicle based on the information received. 

10 U.S. Pat. Nos. 5.055.851 and 4.891.650 make use of the 
cellular network in a similar fashion. That is. the stolen 
vehicle sends an identification code and RSSI level to the 
closest cell site. The active cell site which receives the 
information reports the theft to the cellular MTSO and the 

*3 MTSO transmits the information to an alarm station which 
identifies the vehicle and cell site. 

A problem associated with the aforementioned systems is 
thai in most instances, cell sites located in metropolitan areas 
make use of low-powered 120° directional antennas to cover 

20 a densely populated and developed area which may have a 
large number of buildings, highways, side streets, parking 
lots, garages and other facilities where the thief may be able 
to hide the vehicle. Thus, although the aforementioned 
systems may be able to locate the general location of the 

25 vehicle with respect to a cell site antenna, the probability of 
locating the vehicle in short order is still fairly small and 
mostly based on luck. Furthermore, cell sites located in 
urban areas cover very large areas with high-powered, 
omnidirectional antennas, making location finding even 

30 more difficult since the antennas are omnidirectional as 
opposed to sectorized. In both cases, buildings, underground 
parking lots, mountains and other obstacles often cause the 
towers to report false RSSI readings to the MTSO. 

3j Yel another problem associated with the aforcmeritiorjed 
systems is that most of the techniques require in some form 
or another modification to the existing cellular infrastructure 
software to enable a cellular service provider to track and 
monitor movement of a stolen vehicle. In most instances, 
cellular service providers are in the majority reluctant to 
make any modification to their software for the purpose of 
tracking stolen vehicles. 

A need therefore exists for providing a vehicle tracking 
method and system using existing cellular network infira- 
45 structure which can overcome the problems associated with 
the prior art. 

Accordingly, it is an object of the present invention to 
provide a vehicle tracking method and system which make 
use of the existing cellular network infrastructure, but 

50 wherein the cellular service provider is not required to 
modify its software in order to identify the general location 
of a stolen vehicle. 

Another object of the present invention is to provide a 
vehicle tracking method and system which make use of the 

3 5 existing cellular network infrastructure, wherein a tracking 
vehicle making use of a radio signal direction finder is used 
to quickly obtain a more accurate indication of the location 
of the stolen vehicle can be obtained. 
Another object of the present invention is to provide a 

60 vehicle tracking method and system which make use of the 
existing cellular network infrastructure, wherein a stolen 
vehicle can be tracked by keeping a voice channel open 
between the cellular network and a locating cellular trans- 
ceiver installed in the stolen vehicle. 

65 Yet another object of the present invention to provide a 
vehicle tracking method and system using the cellular net- 
work infrastructure, wherein the general location of the 
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stolen vehide can be determined by paging a cellular 
transceiver located in the stolen vehicle to permit identifi- 
cation by the MTSO of one or more cell sites Located near 
the stolen vehicle and relaying the information to a tracking 
vehicle which makes use of a radio direction finder to obtain 5 
an accurate bearing on the location of the stolen vehicle. 

Yet another object of the present invention to provide a 
vehicle tracking method and system which make use of the 
existing cellular network infrastructure wherein the cellular 
transceiver which is installed in a vehicle that requires w 
tracking, operates on a continuous standby mode for track- 
ing its general location and is turned to an active mode when 
tracking of the vehicle is initiated. 

Yet another object of the present invention is to provide a 
method and system of locating a stolen vehicle using exist- 
ing cellular infrastructure, wherein a tracking vehicle pro- 
vided with a radio direction finder can determine using a 
global positioning system receiver its location with respect 
to one or more cell sites identified as being dose to said 
stolen vehicle such that the tracking vehicle can quickly 
travel to the area identified by the selected cell sites. 2° 

In accordance with an embodiment of the present 
invention, there is provided a method of locating a stolen 
vehicle provided with a locating cellular transceiver, using 
the existing cellular network infrastructure, comprising the 
steps of: '2$ 

(a) receiving an indication that said vehicle has been 
stolen; 

(b) paging said locating cellular transceiver; 

(c) maintaining an open voice channel with said locating 
cellular transceiver of said stolen vehicle; 30 

(d) estimating the coordinates of the vehicle location 
based on the location of a cell site conimunicating with said 
locating cellular transceiver. 

(e) detrnniniag the location of a search vehicle with 
respect to said one or more cell sites; 35 

(f) monitoring said open voice channel from said search 
vehicle; and 

(g) locating said stolen vehicle based on the direction of 
arrival of RF signals emitted by said stolen vehide and 
received at said search vehide. 40 

In accordance with a further embodiment of the invention, 
there is provided a system for locating a stolen vehide 
provided with a locating cellular transceiver, said system 
operating using the existing cellular network infrastructure, 
comprising: 45 

(a) means for receiving an indication that said vehicle has 
been stolen; 

(b) means for paging said locating cellular transceiver. 

(c) cdlular radio means for maintaining an open voice 
channel with said Locating cellular transceiver of said stolen 50 
vehicle; 

(d) means for estimating the coordinates of the vehicle 
location based on the location of one or more cell sites 
communicating with said locating cellular transceiver, 

(e) positioning means for determining the location of a 55 
search vehicle with respect to said one or more cell sites; 

(0 radio means for monitoring said open voice channel 
from said search vehicle; and 

(g) radio location finder means for locating said stolen 
vehicle based on the direction of arrival of RF signals 60 
emitted by said stolen vehicle and recdved at said search 
vehicle. 



In accordance with an embodiment of the present 
invention, there is provided a method of obtaining 
locating information concerning a locating cellular 
transceiver usino the existing cellular network 
infrastructure, comprising the steps of: 

receiving transmitted signals from the cellular 
transceiver at one or more cell sites within operational 
range of the cellular transceiver: 

establishing and maintaining an open voice 
channel with the locating cellular transceiver: 

determining a cell site sector within the network 
in which the cellular transceiver is located based on 
the location of the one or more cell sites 
communicating with the locating cellular transceiver: 

determining a general geographical location of a 
search vehicle with respect to the one or more cell 
sites: 

moving the search vehicle to the cell site sector 
of the cellular transceiver and monitoring the open 
voice channel from the search vehicle: and 

obtaining a direction in which the cellular 
transceiver is located with respect to the search 
vehicle based on the direction of arrival of RF signals 
emitted by the cellular transceiver and received at the 
search vehicle. 

Preferably, the method further comprises the step 
of Querying the cellular network for the general 
location of the transceiver based on the last known 
location of the transceiver in the cellular network. 

Preferably, the step of Querying comprises 
determining the Electronic Serial Number (ESN) of 
the locating cellular transceiver associated with the 
stolen vehicle and assigning the ESN with a 
predetermined Number Assigned Mobile (NAM) such 
that the locating cellular transceiver associated with 
the stolen vehicle can be paged bv the existing 
cellular network. 

Preferably, the search vehicle monitors the 
transmit freguencv of the open voice channel. 

Preferably, the search vehicle locates the cellular 
transceiver using a radio freguencv direction finder 
tuned to the transmit freguencv of the open voice 
channel. 

Preferably, the locating cellular transceiver is on 
a full-time standby mode until an indication that the 
transceiver needs to be located. 

Preferably, the locating cellular transceiver is 
switched to an active mode to open the voice channel 
until the transceiver is located. 

Preferably, the location of the search vehicle with 
respect to the one or more cell sites is determined bv 
downloading the longitude and latitude coordinates of 
one of the sites into a GPS receiver mounted on the 
search vehicle. 

Preferably, the method further comprises a step 
of paging the locating cellular transceiver. 

Preferably, the method further comprises a step 
of conceilinglv mounting the transceiver within a 
vehicle to be located if stolen, wherein the method 
serves to locate a stolen vehicle. 
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Preferably, the transceiver comprises a 
rechargeable battery supply and is connected to a 
battery power supply of an engine of the stolen 
vehicle. 

According to another broad aspect of the present 
invention, there is provided a method of obtaining 
locating information concerning a locating cellular 
transceiver using the existing cellular network 
infrastructure, the infrastructure receiving transmitted 
signals from the cellular transceiver at one or more 
cell sites within operational range of the cellular 
transceiver, establishing and maintaining an open 
voice channel with the locating cellular transceiver, 
determining a ceil site sector within the network in 
which the transceiver is located based on the location 
of the one or more cell sites communicating with the 
locating cellular transceiver. The method comprises 
the steps of: 

placing a reouest with the existing cellular 
network infrastructure to determine the cell site sector 
for the cellular transceiver and to maintain the open 
voice channel and obtaining in response to the 
reguest an identification of the cell site sector; 

determining a general geographical location of a 
search vehicle with respect to the one or more cell 
sites: 

moving the search vehicle to the cell site sector 
of the transceiver and monitoring the open voice 
channel from the search vehicle: and 

obtaining a direction in which the transceiver is 
located with respect to the search vehicle based on 
the direction of arrival of RF signals emitted by the 
cellular transceiver and received at the search 
vehicle. 

Preferably, obtaining the direction of the 
transceiver comprises using a radio freouencv 
direction finder tuned to a transmit freouencv of the 
open voice channel. Preferably, the location of the 
search vehicle with respect to the one or more cell 
sites is determined by downloading the longitude and 
latitude coordinates of one of the sites into a GPS 
receiver mounted on the search vehicle. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The invention will be better understood by an examina- 65 
tion of the following description, together with the accom- 
panying drawings, in which: 
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Fig. la illustrates a typical cluster of cells in a cellular 
communication system; 

Fig. lb illustrates generally how a vehicle is monitored 
within the cellular communication system of Fig. la; 
3 FIG. 2a is an illustration of a typical setting of a cell site 
with 120° sectorizauoo in a metropolitan area: 

FIG. 2b is an illustration of a typical setting of a cell site 
with an omnidirectional antenna in an urban area: 
10 FIG. 3a is a block diagram of the locating cellular 
transceiver of the present invention; 

FIG- 3b is an illustration of the vehicle tracking system of 
the present invention; 
FIG. 3c is a diagram illustrating how a stolen vehicle can 
13 be (racked with the system of FIG. 3b; 

FIG. 4a is a block diagram of the vehicle tracking 
equipment provided on a search vehicle; and 
FIG. 4b is a diagram illustrating the location of direction 
^ finding. GPS and transceiver antennae used with the system 
of FIG. 4a t 

DESCRIPTION OF THE PREFERRED 
EMBODIMENTS 

y Referring now to FIG. I. we have shown a typical cell 
cluster 10 forming part of a larger cellular network (not 
shown). This particular cluster is commonly known as a 
7-cell pattern. Either these 120° segmented cells (FIG. 2a) or 
tiered omnidirectional cells (FIG. 2b) are used. In the 
example of Fig. la, a mobile station 11 is being served by 
base station 12 of cell 13. Base stations 14 and 15 of cells 
16 and 17 respectively, are also within radio range of mobile 
station 11. As shown in Fig. lb. as the mobile 11 travels, a 
request for signal strength measurements will be sent by the 

35 serving station 12 to neighbouring cells, in this case cell 14. 
If the strongest received signal strength indication (RSSI) is 
received from a neighbouring base station, such as base 
station 14, the serving base station 12 will select the neigh- 
bouring base station as the hand-off target base station. Le. 

4Q the next base station to serve the mobile base station. The 
cellular service of vehicle 11. as it moves from cell site to 
cell site, is of course controlled by a mobile telephone 
switching office 18 to provide the best service for the cellular 
user. 

45 When a cellular transceiver is used for tracking a stolen 
vehicle in a metropolitan area, such as shown in FIG. 2a. a 
densely populated and developed area covering several 
streets and buildings is serviced by the coverage area of each 
sector of a cell site 2ft communicating with a stolen vehicle 

50 21. Although a general estimate of the location of stolen 
vehicle 21 can be determined, say. within a 120° area of a 
cellular cluster such as shown in FIG. 2a. it becomes 
extremely difficult to pinpoint the exact location of vehicle 
21 which may be located in any one of the streets or within 

55 a building within the vicinity of the cell site 20. Thus, even 
though vehicle 21 might be in communication range with 
cell site 2t. the radio coverage of cell site 2t may cover 
several blocks within a metropolitan area. Thus, even if a 
tracking or search vehicle such as a police car or other 

eo private security service company is able to locate the stolen 
vehicle 21 generally within the coverage area of one sector 
of cell site 20. it may be difficult or even impossible to 
exactly pinpoint the location of the stolen vehicle, especially 
if the vehicle is located within a closed garage for disas- 

65 semMy. 

Referring now to FIG. 3a. we have shown a block 
diagram of a locating cellular transceiver for installation in 



-4- 



5 

a vehicle. The transceiver 30 should preferably be installed 
in a bidden location lo prevent the unit from being readily 
noticed and removed by a potential thief. Antenna 31 need 
not be connected to the standard 3 dB whip-type antenna 
normally mounted on a window the vehicle. In particular. 5 
antenna 31 is adapted to be inconspicuously laid out inside 
the vehicle. The cellular transceiver 30 is connected directly 
to a constant 12 volt power source, such as the car battery 
and may be provided with a back-up battery 32 to prevent 
the transceiver 30 from being disabled if the cables to the car Q 
battery arc disconnected. The cellular transceiver 30 is 
designed to operate full-time in a standby mode. The cellular 
transceiver 36 is designed to draw a minimum amount of 
current such that it can be maintained in a standby mode 
continuously once installed. Similarly even in an active j5 
mode, when the transceiver is required to operate at higher 
transmit power, very little current will be drawn from the car 
battery. The cellular transceiver 30 is designed to operate in 
the same way as a standard telephone transceiver in that it 
will respond to queries from the cellular network at periodic ^ 
intervals to provide the network with an indication of its 
operating status. The cellular transceiver 30 will respond to 
standard commands and queries from the network such as 
when the RSSI level with respect to a particular cell site is 
required. It can also receive commands from the cellular ^ 
network if the transceiver transmit power level needs to be 
changed, such as when the cellular transceiver is paged. The 
power level can vary from a minimum of 02 watts to a 
maximum of 0.6 watts such as is currently used in standard 
cellular telephones. The locating cellular transceiver 30 is ^ 
provided with standard components, such as power supply 
33. memory and processor circuit 34. RF circuit 35 and. if 
required, an optional IO circuit 36. Optional 10 circuit 36 
can be provided to connect a variety of sensors 37 to detect 
thai an alarm has been triggered on the vehicle or that the 35 
ignition 33 has been activated by an unauthorized user. 
Other options, such as* remote engine kill, car starter and 
remote door locks can also be used as well. 

The optional IO circuit 36 can also be connected to an 
audio source 39 such as a hidden microphone to enable the ^ 
security service provider to hear any conversation the thief 
might be having in the vehicle. 

Referring now to FIGS. 3£ and 3c. we have shown a 
diagram illustrating the vehicle tracking system of the 
present invention. In order to be provided with the vehicle 45 
tracking service of the present invention, a vehicle operator 
would first have the locating cellular transceiver illustrated 
in FIG. 3a installed in the vehicle. The locating cellular 
transceiver would be provided, as any other cellular 
telephone, with an electronic serial number (ESN) unique to 50 
the transceiver. The identity of the vehicle owner or operator 
and the transceiver's Electronic Serial Number (ESN) are 
added to a customer database of the security service pro- 
vider. The installation of the locating cellular transceiver and 
registration of the ESN would of course be done via a 35 
security service provider authorized by the cellular service 
provider to assign new cellular accounts, such as is currently 
done with the purchase of cellular phones. 

Normally, when calls to and from a cellular transceiver 
are made, the cellular network will verify the cellular 60 
transceiver's 10-digit telephone number (NAM. Number 
Assigned Mobile) and ESN (Electronic Serial Number) 
before allowing the call to go through. Each cellular tele- 
phone is provided with a unique telephone number (NAM) 
which corresponds to a unique ESN. $5 

With the system of the present invention, the locating 
cellular transceiver will still provide its ESN when queried 
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by the network. However, in order to reduce the costs 
associated with offering the vehicle locating service, a single 
NAM is used for all or a group of locating transceivers. As 
will be described further below, only the locating transceiver 
5 having the correct ESN will respond to queries from the 
cellular network, even if each locating transceiver makes use 
of the same NAM. 

Once the locating cellular transceiver is installed and in 
operation, the user becomes registered with the security 
10 service provider. The security provider enters the locating 
transceiver's ESN in a database with the customer's per- 
sonal information, such as residential address, telephone 
number, vehicle description and serial number, etc. The 
cellular transceiver which is now hidden in vehicle 40 
15 operates in a passive or standby mode within the cellular 
network infrastructure From time to time, at predetermined 
intervals, the locating cellular transceiver will be queried by 
the network to provide an indication of its location within 
the network. For example, in FIGS. 3fc and 3c. the locating 
20 cellular transceiver of vehicle 40 will be paged from time to 
time over a paging channel 41. The paging request is 
generated from any one of the cell sites A, B or C. Upon 
receiving the paging request the locating cellular trans- 
ceiver switches over to an active mode to transmit a response 
25 to the nearest cell site to identify amongst other things, the 
signal quality or RSSI level This way. the cellular service 
provider 42 can keep track of various cellular telephones 
within the network and their locations, such that when an 
incoming call arrives, the call can be directed to a cell site 
30 located nearest to the cellular telephone user. This informa- 
tion is updated from time to time in a database 43. The 
response may or may not be used by the network, according 
to the need to keep track of individual transceivers. 
When the security service provider 44 receives ah indi- 
35 cation that vehicle 40 has been stolen, a call is made to a 
cellular service provider to request a standard change of 
ESN. The ESN corresponding to that of the cellular trans- 
ceiver located in the stolen car is programmed in the 
database 43 to match the pre-established common NAM. At 
40 this point, a rxeiiminary query is made to determine the 
current location of the stolen vehicle 40 within the cellular 
network. As in the prior art a general estimate of the 
location of stolen vehicle 21 can be determined, say. within 
a 120* area of a cellular cluster such as shown in FIG. 2a. 
45 namely by identifying the cell site sector communicating 
with the transceiver. The security service provider dials the 
pre-selected telephone number, i.e. common NAM associ- 
ated with locating cellular transceivers. The call is processed 
as a normal incoming cellular call by the network operator. 
50 The cellular network operator receives the dialed digits, 
checks its database for the associated ESN (now equivalent 
to ESN of stolen vehicle), then transmits, on the cellular 
network, a new paging signal containing the common NAM 
and unique ESN of the stolen vehicle The only transceiver 
55 to respond will be the one associated with the stolen vehicle 
and a voice channel illustrated by arrow 46 is opened 
between the locating cellular transceiver of vehicle 40 and a 
nearby cell site. This voice channel is kepi open, as if a 
normal conversation was taking place. However, the secu- 
60 rity service provider is now in control of the opened voice 
channel and will keep it open until the vehicle is located. In 
this example, cell site A is currently communicating with the 
transceiver over voice channel 46. Then, the security service 
provider 44 forwards the identity of the stolen vehicle to a 
65 security response team located in tracking vehicle 47. The 
team is provided with the current location of vehicle 40 
based on the closest cell site sector where the vehicle is 
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